Bug 1848358

Summary:	CRDs with preserveUnknownFields:true don't reflect in status that they are non-structural
Product:	OpenShift Container Platform	Reporter:	Stefan Schimanski <sttts>
Component:	kube-apiserver	Assignee:	Stefan Schimanski <sttts>
Status:	CLOSED ERRATA	QA Contact:	Xingxing Xia <xxia>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	4.5	CC:	aos-bugs, erich, mfojtik
Target Milestone:	---
Target Release:	4.7.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	Cause: preserveUnknowsFields is true in v1beta1 CRDs Consequence: There is no obvious error when "oc explan" does not explain CRD fields Fix: Added a validation condition for non structural schema preserveUnknownFields field Result: Status of v1beta1 CRDs without "preserveUnknownFields:false" will show violation "spec.preserveUnknownFields: Invalid value: true: must be false"	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-02-24 15:12:21 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1885620

Description Stefan Schimanski 2020-06-18 08:43:10 UTC

Description of problem:

CRDs with preserveUnknownFields:true won't be published via OpenAPI and oc explain will not work. This is intentional. But:

Nothing in the CRD status suggests that preserveUnknownFields:true is the problem. 

How reproducible:

Create a CRD in apiextensions.k8s.io/v1beta1 

- with a structural schema
- but without preserveUnknownFields being set at all. 

The default for that field is true, and hence that CRD won't get a published schema.

Actual results:

`oc explain` won't show descriptions of fields.

Expected results:

The NonStructural condition on the CRD should show: "preserveUnknownFields must not be true".

Comment 1 Venkata Siva Teja Areti 2020-06-18 11:18:50 UTC

I will work on this after finishing up my current tasks.

Comment 2 Venkata Siva Teja Areti 2020-07-09 19:16:23 UTC

I might find some time in this sprint to work on this.

Comment 3 Venkata Siva Teja Areti 2020-07-31 18:46:55 UTC

I am working on other high priority items. I will get to this bug next sprint.

Comment 4 Venkata Siva Teja Areti 2020-08-21 22:02:38 UTC

I am occupied with other priority items. Working on this bug will be re-evaluated in next sprint.

Comment 10 Xingxing Xia 2020-10-15 14:59:54 UTC

First read Stefan's https://kubernetes.io/blog/2019/06/20/crd-structural-schema/ about structural and non-structural schema.
Then create a CRD in apiextensions.k8s.io/v1beta1:
- with a structural schema
- but without preserveUnknownFields being set at all
$ cat crd.yaml
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: testcrs.example.com
spec:
  group: example.com
  names:
    kind: TestCR
    plural: testcrs
  scope: Namespaced
  validation:
    openAPIV3Schema:
      type: object
      description: this is description for the crd
      properties:
        spec:
          type: object
          description: this is description for spec
          properties:
            a:
              type: string
              description: this is description for field a
  version: v1
  versions:
  - name: v1
    served: true
    storage: true

$ oc create -f crd.yaml

Then check oc explain, indeed cannot show description of fields.
Then check oc get crd testcrs.example.com -o yaml, 4.7.0-0.nightly-2020-10-15-051208 env shows condition NonStructuralSchema as below, this is expected by the PR (4.6.0-0.nightly-2020-10-14-095718 env does not show it).
...
spec:
...
  preserveUnknownFields: true
...
  conditions:
  - lastTransitionTime: "2020-10-15T14:50:01Z"
    message: 'spec.preserveUnknownFields: Invalid value: true: must be false'
    reason: Violations
    status: "True"  
    type: NonStructuralSchema

Comment 14 errata-xmlrpc 2021-02-24 15:12:21 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.7.0 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:5633